paypal-postman-lib@1.0.2

Analysis

combosquat namespace-reservation publish: the package name impersonates "PayPal Postman" (a legitimate API-client tool) by appending "-lib". The tarball contains only a package.json file (274 bytes) with no executable code, and declares a circular self-dependency on itself (paypal-postman-lib@^1.0.1). The package name is associated with previously flagged malware. The publisher staked the name but shipped no code — a typical namespace-grab pattern before delivering malicious payloads in a later version.